Modular Multiplication Device Constant-Time Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Asymmetric cryptographic systems are vulnerable to side-channel attacks, particularly due to the presence of extra-reduction in modular multiplication operations, which can lead to data leakage and compromise the security of private keys, even with countermeasures like data blinding.
Innovation Solution
A modular multiplication device and method that selects an extension parameter to eliminate the need for extra-reduction, ensuring deterministic timing and fault injection resistance by using an extended modulus, thereby protecting against attacks based on conditional reduction and side-channel information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If Montgomery Modular Multiplication is used for fast cryptographic operations, then computational speed is improved, but extra-reduction operations create timing variations that leak private key information through side-channel attacks
Solution Approach 1:
The invention changes the parameter of the modulus by introducing an extended modulus N' = N × r where r is an extension parameter. This parameter change transforms the modular multiplication operation to eliminate conditional extra-reduction steps, ensuring constant execution time while maintaining cryptographic security. The extended modulus allows the computation to always complete in the same number of steps regardless of intermediate values, preventing timing-based side-channel attacks.
2Manufacturing precision
If conditional extra-reduction is performed in modular multiplication, then the result is correctly reduced modulo N, but the conditional operation creates variable timing that compromises security
Solution Approach 1:
The invention performs preliminary action by selecting the extension parameter r such that the extended modulus N' = N × r is greater than the maximum possible product of two multiplicands. This preliminary setup ensures that no extra-reduction is ever needed during the computation, as the product is already guaranteed to be less than N'. The constant-time operation is achieved by design rather than by conditional checks during execution.
3Reliability
If data blinding countermeasures are implemented, then some protection against side-channel attacks is provided, but computational overhead increases and timing variations may still occur
Solution Approach 1:
Instead of applying data blinding to hide the operations, the invention inverts the approach by designing the modular multiplication algorithm itself to not require any conditional operations. By using the extended modulus and ensuring the product is always less than the extended modulus, the algorithm naturally achieves constant-time execution without needing data blinding or other complex countermeasures, thereby reducing overall computational overhead.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
There is provided a modular multiplication device for performing a multiplication of a first multiplicand and a second multiplicand modulo a given modulus, each of the multiplicand comprising a given number of digits, each digit having a given word size. The modular multiplication device comprises: - a multiplier for multiplying at least one digit of the first multiplicand with the second multiplicand to produce a multiplier output; - a modular reduction unit configured to reduce a quantity derived from the multiplier output by the product of an extended modulus and an integer coefficient, the extended modulus being the product of the given modulus with an extension parameter, which provides a reduction output, the reduction output being a positive integer strictly smaller than the extended modulus, wherein the modular multiplication device further comprises a selection unit configured to select the extension parameter such that the time taken for the device to perform the multiplication is independent from the multiplicands.